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IN THE CLAIMS: 
Amended claims follow: 



1 . (Currently Amended) A method for emulating computer viruses 
and/or malicious software that operates by patching additional program 
instructions into an emulator in order to aid in detecting a computer virus and/or 
malicious software within suspect code, the method comprising: 

receiving the suspect code; 

loading the suspect code into an emulator buffer within a data space of a 
computer system ; 

loading a first emulator extension into the emulato r, the emulator capable 
of performing an emulation using emulation code , the first emulator extension 
including program instructions that aid in the process of emulating the suspect 
code in order to detect a computer virus and/or malicious software , wherein the 
program instructions of the first emulator extension are additional beyond that 
associated with the emulator code, for assisting the emulator code in the 
emulation bv patching the addilional program instructions into the emulator in 
order to aid in detecting the computer virus and/or malicious software within the 
suspect code : 

performing anthe emulation using the first emulator extensio n, the 
emulation code and the suspect code, the emulation being performed within an 
insulated environment in the computer system so that the computer system is 
insulated from malicious actions of the suspect code; and 
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determining whether the suspect code is likely to exhibit malicious 
behavior based upon the emulation. 

2. (Original) The method of claim 1 , wherein loading the first 
emulator extension into the emulator includes loading the first emulator extension 
into the emulator buffer within the emulator; and 

wherein performing the emulation includes emulating the program 
instructions that comprise the i irst emulator extension. 

3. (Original) The method of claim 2, wherein emulating the program 
instructions that comprise the first emulator extension causes the emulator to 
examine the suspect code looking for patterns that indicate that the suspect code is 
likely to exhibit malicious behavior. 

4. (Original) The method of claim 2, wherein emulating the program 
instructions that comprise the first emulator extension causes the program 
instructions within the first emulator extension to facilitate emulation of the 
suspect code. 

5. (Original) The method of claim 1 , further comprising emulating the 
suspect code prior to loading the first emulator extension into the emulator buffer. 

6. (Original) The method of claim 1 , further comprising: 
loading a second emulator extension into the emulator; and 
performing a second emulation using the second emulator extension and 

the suspect code. 
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7. (Original) The method of claim 6, wherein the first emulator 
extension and the second emulator extension provide support for conflicting 
emulator environments. 

8. (Original) The method of claim 1 , wherein loading the first 
emulator extension involves loading the first emulator extension from a database 
containing a plurality of different emulator extensions. 

9. (Original) The method of claim 1 , wherein the first emulator 
extension includes code for decrypting an encrypted computer virus and other 
encrypted malicious code. 

1 0. (Original) The method of claim 1 , further comprising if a computer 
virus or other malicious software is detected within the suspect code, disinfecting 
the suspect code. 

1 1 . (Original) The method of claim 1 , wherein the first emulator 
extension facilitates emulating a non-standard computer instruction opcode. 

12. (Original) The method of claim 1, wherein the first emulator 
extension facilitates emulating an uncommonly used operating system call. 

13. (Currently Amended) A computer-readable storage medium storing 
instructions that when executed by a computer cause the computer to perform a 
method for emulating computer viruses and/or malicious software that operates by 
patching additional program instructions into an emulator in order to aid in 
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detecting a computer virus and/or malicious software within suspect code, the 
method comprising: 

receiving the suspect code; 

loading the suspect code into an emulator buffer within a data space of a 
computer system; 

loading a first emulator extension into the emulato r the emulator cap ahle 
of performing an em ulation using emulation code, the first emulator extension 
including program instructions that aid in the process of emulating the suspect 
code in order to detect a computer virus and/or malicious software , wherein the 
program instructions of the first emulator extension are additional bevond that 
associated with the emulator code, for assisting the emulator code in the 
emulation by patching the additional program instructions into the emulator in 
order to a id in detecting the computer virus and/or malicious software within the 
suspect code : 

performing aathe emulation using the first emulator extension , the 
emulation code and the suspect code, the emulation being performed within an 
insulated environment in the computer system so that the computer system is 
insulated from malicious actions of the suspect code; and 

determining whether the suspect code is likely to exhibit malicious 
behavior based upon the emulation. 

14. (Original) The computer-readable storage medium of claim 13, 
wherein loading the first emulator extension into the emulator includes loading 
the first emulator extension into the emulator buffer within the emulator; and 

wherein performing the emulation includes emulating the program 
instructions that comprise the first emulator extension. 
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1 5 . (Original) The computer-readable storage medium of claim 1 4, 
wherein emulating the program instructions that comprise the first emulator 
extension causes the emulator to examine the suspect code looking for patterns 
that indicate that the suspect code is likely to exhibit malicious behavior. 

16. (Original) The computer-readable storage medium of claim 14, 
wherein emulating the program instructions that comprise the first emulator 
extension causes the program instructions within the first emulator extension to 
facilitate emulation of the suspect code. 

17. (Original) The computer-readable storage medium of claim 13 s 
wherein the method further comprises emulating the suspect code prior to loading 
the first emulator extension into the emulator buffer. 

1 8. (Original) The computer-readable storage medium of claim 1 3, 
wherein the method further comprises: 

loading a second emulator extension into the emulator; and 
performing a second emulation using the second emulator extension and 
the suspect code. 

19. (Original) The computer-readable storage medium of claim 18, 
wherein the first emulator extension and the second emulator extension provide 
support for conflicting emulator environments. 

20. (Original) The computer-readable storage medium of claim 13 7 

, wherein loading the first emulator extension involves loading the first emulator 
extension from a database containing a plurality of different emulator extensions. 
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21. (Original) The computer-readable storage medium of claim 13, 
wherein the first emulator extension includes code for decrypting an encrypted 
computer virus and other encrypted malicious code. 

22. (Original) The computer-readable storage medium of claim 13, 
wherein if a computer virus or other malicious software is detected within the 
suspect code, the method further comprises disinfecting the suspect code. 

23. (Original) The computer-readable storage medium of claim 1 3, 
wherein the first emulator extension facilitates emulating a non-standard computer 
instruction opcode > 

24. (Original) The computer-readable storage medium of claim 13, 
wherein the first emulator extension facilitates emulating an uncommonly used 
operating system call. 

25. (Currently Amended) An apparatus that emulates computer viruses 
and/or malicious software that operates by patching additional program 
instructions into an emulator in order to aid in detecting a computer virus and/or 
malicious software within suspect code, the apparatus comprising: 

a loading mechanism that is configured to load the suspect code into an 
emulator buffer within a data space of a computer system; 

wherein the loading mechanism is additionally configured to load a first 
emulator extension into the emulato r, the emulator canable of performing an 
emulation using emulation codc > the first emulator extension including program 
instructions that aid in the process of emulating the suspect code in order to detect 
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a computer virus and/or malicious software , wherein the program instructions of 
the first emulator extension are additional beyond that associated with the 
emulator code, for assisting the emulator code in the emulation bv patching the 
additional program instructions into the emulator in order to aid in detecting the 
computer virus and/or malicious software within the suspect code ; 

an emulation mechanism that is configured to perform anthe emulation 
using the first emulator extension , the emulation code and the suspect code, the 
emulation being performed within an insulated environment in the computer 
system so that the computer system is insulated from malicious actions of the 
suspect code; and 

a determination mechanism that is configured to determine whether the 
suspect code is likely to exhibit malicious behavior based upon the emulation. 

26. (Original) The apparatus of claim 25, wherein the loading 
mechanism is configured to load the first emulator extension into the emulator 
buffer within the emulator; and 

wherein the emulation mechanism is configured to emulate the program 
instructions that comprise the first emulator extension. 

27. (Original) The apparatus of claim 26, wherein emulating the 
program instructions that comprise the first emulator extension causes the 
emulation mechanism to examine the suspect code looking for patterns that 
indicate that the suspect code is likely to exhibit malicious behavior. 

- 28. (Original) The apparatus of claim 26, wherein emulating the 
program instructions that comprise the first emulator extension causes the 
emulation mechanism to facilitate emulation of the suspect code. 
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29. (Original) The apparatus of claim 25, wherein the emulator is 
configured to emulate the suspect code prior to loading the first emulator 
extension into the emulator buffer. 

30. (Original) The apparatus of claim 25, wherein the loading 
mechanism is additionally conilgured to: 

load a second emulator extension into the emulator: and to 
perform a second emulation using the second emulator extension and the 
suspect code. 

3 1 . (Original) The apparatus of claim 30, wherein the first emulator 
extension and the second emulator extension provide support for conflicting 
emulator environments. 

32. (Original) The apparatus of claim 25, wherein the loading 
mechanism is configured to load the first emulator extension from a database 
containing a plurality of different emulator extensions. 

33. (Original) The apparatus of claim 25, wherein the first emulator 
extension includes code for decrypting an encrypted computer virus and other 
encrypted malicious code. 

34. (Original) The apparatus of claim 25, further comprising a 
disinfecting mechanism that is configured to disinfect the suspect code if a 
computer virus or other malicious software is detected within the suspect code. 
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35. (Original) The apparatus of claim 25, wherein the first emulator extension is 
configured to facilitate emulating a non-standard computer instruction opcode. 

36. (Original) The apparatus of claim 25, wherein the first emulator extension is 
configured to facilitate emulating an uncommonly used operating system call. 

37. (New) The method of claim 1 , wherein if the computer virus and/or malicious 
software is not detected, it is determined if there are any remaining emulator extensions 
remaining in a database that have not already been used, wherein if there are any remaining 
emulator extensions remaining in the database that have not already been used, a next 
emulator extension is loaded into the emulator to repeat the emulation using the next 
emulator extension. 
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